DNS already supports encryption on the protocol level. And even if you can’t use DOH/DOT, you can use PGP or age or whatever in your clear text too.

  $ dig +short @<trusted_server> TXT <encrypted_content>.
  <encrypted_content_back>